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FIG. 4 
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FIG. 5 
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IF SYSTEM ATTACK BY EXTERNAL ATTACKER IS 
DETECTED, OUTPUT ATTACK SENSING SIGNAL 
CONTAINING SOURCE AND DESTINATION IP 
ADDRESSES OF ATTACK PATH, AND PORT NUMBER 



IF ATTACK SENSE SIGNAL IS RECEIVED, BLOCK 
ATTACK PACKET TRANSMITTED TO SYSTEM AND 
RESPONSE PACKET OUTPUT FROM SYSTEM 
IN RESPONSE TO ATTACK PACK 



GENERATE RESPONSE PACKET, INTO WHICH 
WATERMARK IS INSERTED, IN RESPONSE TO 
ATTACK PACKET AND TRANSMIT TO SOURCE 
ADDRESS OF ATTACK PACKET 
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RECEIVE ONE OR MORE WATERMARK DETECTION 
PACKETS FROM OUTSIDE 



TRACE LOCATION OF ATTACK AND SYSTEM 
BASED ON IP ADDRESS AND PORT NUMBER 
CONTAINED IN DETECTION PACKET 
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FIG. 6 
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GENERATE DETECTION PACKET 

CONTAINING SOURCE OF 
RECEIVED PACKET, DESTINATION 
IP ADDRESS AND PORT NUMBER 
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TRANSMIT DETECTION PACKET 
TO SYSTEM WHICH FIRST INSERTS 
WATERMARK INTO RECEIVED PACKET 
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